Analysis
- max time kernel
148s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
24/01/2023, 14:39
General
- Target INVOICE.exe
- Size 743KB
- Sample230124-rz96msdg21
- SHA256 51b75048fd9a1f0f9ad1a76c1009b3db3fd14701e7ce770370fb0f6ffaa0042f
Malware Config
Extracted
-
formbook
-
4.1
-
jn21
-
lordmikeagency.africa
-
d4tri.com
-
flareicon.com
-
deckandcottage.com
-
blg807.xyz
-
abctestservices.com
-
2022xin38.bar
-
cjwservicespressureexpert.com
-
brighampartners.com
-
immoswipe.net
-
barriedrawingpainting.com
-
chasingtimemovie.com
-
1wizzc.top
-
kimnguyendemo.tech
-
gabonais.store
-
hotdealz.africa
-
bonchuk.ru
-
concretizarconsorcios.com
-
carolynhowells.ltd
-
kfp0g4.shop
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 5 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1028-142-0x0000000007EA0000-0x0000000008039000-memory.dmp
memory/1028-156-0x00000000082F0000-0x000000000838A000-memory.dmp
memory/1028-154-0x00000000082F0000-0x000000000838A000-memory.dmp
memory/1028-152-0x00000000080E0000-0x000000000826A000-memory.dmp
memory/1028-145-0x00000000080E0000-0x000000000826A000-memory.dmp
memory/2912-151-0x00000000014A0000-0x00000000017EA000-memory.dmp
memory/2912-155-0x00000000001A0000-0x00000000001CF000-memory.dmp
memory/2912-153-0x00000000012B0000-0x0000000001344000-memory.dmp
memory/2912-148-0x0000000000570000-0x000000000064C000-memory.dmp
memory/2912-149-0x00000000001A0000-0x00000000001CF000-memory.dmp
memory/3576-133-0x00000000054B0000-0x0000000005A54000-memory.dmp
memory/3576-134-0x0000000004F00000-0x0000000004F92000-memory.dmp
memory/3576-135-0x0000000004FA0000-0x000000000503C000-memory.dmp
memory/3576-136-0x0000000004E60000-0x0000000004E6A000-memory.dmp
memory/3576-132-0x0000000000410000-0x00000000004D0000-memory.dmp
memory/4924-143-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4924-147-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4924-144-0x0000000001470000-0x0000000001485000-memory.dmp
memory/4924-138-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4924-141-0x0000000001200000-0x0000000001215000-memory.dmp
memory/4924-140-0x0000000001500000-0x000000000184A000-memory.dmp